How were computer hackers able to break into the systems of Crédit Mutuel Arkéa and steal tens of millions of euros? The banking group, which brings together the Brittany and South-West federations of the parent company, as well as specialized subsidiaries, such as Fortuneo, confirmed the attack in a press release on Wednesday November 4. He assured that security measures had been taken.
This digital burglary will have no consequences for customers, promises the company, which is continuing its investigations. An investigation has been opened. Franceinfo summarizes what we know about this affair, unprecedented in a generally well-protected sector.
Specialists estimate the amounts stolen at 118 million euros ($133 million). “We do not confirm this information,” said Crédit Mutuel Arkéa in a second press release published late Wednesday afternoon. The group can “simply validate the order of magnitude” – several tens of millions of euros. “Part of the funds concerned may have been blocked, and other actions are underway to recover them,” he added.
“It is therefore still too early to communicate a final amount,” summarized Crédit Mutuel Arkéa, which is part of the National Confederation of Crédit Mutuel (CNCM), but maintains great independence vis-à-vis the central body of the group which has 19 federations. It is “absolutely not likely to call into question the health and financial solidity of Crédit Mutuel Arkéa”. The company generated a net profit of 230 million euros over the first six months of the year, according to its half-yearly report.
“The attackers used Crédit Mutuel Arkéa’s own account to carry out transactions with other banking players,” detailed the group. This is why hacking “has no consequences on [the] assets” of customers. The group mentioned "only (...) a deferred execution of certain transfer operations". “Almost all operations were able to resume their course in the morning [of Wednesday], after the group and its subsidiaries ensured checks and the implementation of reinforced security measures.”
Crédit Mutuel Arkéa has nevertheless warned its customers against scam attempts, via “phishing” (messages pretending to be the bank). Although the company has not mentioned any data theft, such an attack could, however, lead to a wave of scams carried out by opportunistic cybercriminals, who are riding on customer concerns. “It therefore seems essential to us to raise awareness among our customers as a preventive measure by calling on them to be extremely vigilant,” the company underlined.
Initial theories discussed on social networks imagined that the attack could have gone through the device of an employee or service provider unknowingly infected by a virus, which would have stolen their credentials or allowed wider access to the banking group's network. This operating mode is regularly used, as shown by the hacks of the Binance cryptocurrency platform at the beginning of November and of the General Directorate of Public Finances (DGFiP) during the summer.
However, Crédit Mutuel Arkéa has ruled out any "human error", thus excluding a number of operating methods: "This is a sophisticated attack coming from the outside." Its “teams are working with the competent authorities, judicial and police, to precisely determine the origin of the attack and its modus operandi”.
"Contrary to what may have been written" on social networks, "no 'entry' was made by Fortuneo", the online bank owned by Crédit Mutuel Arkéa, the company also wrote. She assured that “the attackers went through the platform of one of our service providers and thus reached Crédit Mutuel Arkéa directly”, without giving further details.
The flight was just the first step. This money was then transferred and converted on cryptocurrency exchange platforms, before being once again subdivided between more and more crypto wallets.
Some of these platforms have taken steps to block stolen funds. The American cryptocurrency platform Kraken, for example, explained to the specialized media Cointelegraph that it had “restricted” accounts suspected of being involved in the movement of funds and was “working with the authorities to support recovery efforts”. The Crypto.com platform declared to the same site that it had “taken appropriate actions to prevent any funds associated with this third-party incident from passing through” it.
“This incident is closed and is now under control,” wrote Crédit Mutuel Arkéa in its first press release. He then specified that his “security devices made it possible to very quickly identify suspicious activities and take the necessary measures to contain the attack”.
“As soon as this attack was identified, our teams immediately activated the necessary security measures to contain the incident and prevent any further fraudulent movement against us,” he detailed. The group, "in accordance with usual procedures", then "approached the competent and supervisory authorities, in order to inform them of the situation".
The cybercrime section of the Paris prosecutor's office was "recipient" on Wednesday morning of "a complaint" from the Crédit Mutuel Arkéa group and "immediately opened an investigation", said the public prosecutor on Wednesday evening, requested by AFP. The investigations relate to a “breach of an automated data processing system in an organized group” and were entrusted to the Anti-Cybercrime Office (Ofac).
